CVE-2026-116044
MediumCVSS 6.3Summary
A vulnerability was detected in prasathmani TinyFileManager up to 2.6 in the remote URL file upload module of tinyfilemanager.php. The manipulation leads to unrestricted upload, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could upload arbitrary files, including malicious code, potentially leading to server compromise. The public exploit increases the risk of rapid exploitation.
Recommendation
Update TinyFileManager to a version later than 2.6 or disable the remote URL file upload feature. Consider restricting access to the application.
Other vulnerabilities in TinyFileManager
See all- CVE-2026-108801Medium
A security flaw in TinyFileManager up to version 2.6 allows unrestricted file upload via the move_uploaded_file function in tinyfilemanager.php by manipulating the fullpath argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2025-15138Medium
A path traversal vulnerability was found in TinyFileManager up to version 2.6 in tinyfilemanager.php. Manipulation of the fullpath argument allows remote attack. The exploit has been published and the vendor did not respond.
Original NVD description (English source)
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS